Attackers are tricking Minecraft players into downloading malware by impersonating popular Minecraft clients and resellers in Google search results. Even after the campaign’s command-and-control infrastructure was taken down, the operation continued by shifting distribution to common file-hosting platforms like Discord, MediaFire, GitHub, and Dropbox.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You Google a Minecraft client like “Xenon Client” and click the top result, without thinking. That’s the WeedHack trap. WeedHack uses SEO poisoning and lookalike Minecraft client sites that promise free or cracked tools. You click download…and the file actually comes from Discord, MediaFire, GitHub, or Dropbox, not the real project site. Here’s the tell: a “free” version of a paid Minecraft tool, hosted on a generic link like Discord or MediaFire, and the URL doesn’t match the official client site. If the download is an unexpected EXE for a mod, that’s your red flag. One move: only download Minecraft clients and mods from the official project site you type in yourself, then let your security software scan the file before you run it.
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
The bulletin describes an APT36 (Transparent Tribe) espionage campaign that uses social-engineering lures and spoofed download portals to trick targets into installing a malicious Windows installer. The installer (“TMS_AfghanTelecom.exe”) deploys the PATCHCORD backdoor, which then calls out to…
Researchers described two active social-engineering-driven malware campaigns: one uses trojanized “popular” remote-user apps (e.g., Zoom/WebEx lookalikes) to trick people into installing credential and crypto-stealing malware, and another uses hundreds of imposter GitHub repositories to lure…
Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…
